pb d'infection search setting 1.1

Section d'analyse de rapports et de désinfection : malwares en tous genre et autres indésirables. Demandes de nettoyage uniquement. Prise en charge restreinte : équipe spécialisée.

Modérateur: Modérateurs

Règles du forum :arrow: Les désinfections sont prises en charge par un groupe spécifique, tout le monde ne peut pas intervenir pour désinfecter les machines (règles).
:arrow: Les procédures sont sur-mesure, ne faites pas la même chose chez vous (explications).
:arrow: Un topic par machine, chacun crée le sien. ;)

pb d'infection search setting 1.1

Messagepar nanou54 » 28 Déc 2009 11:45

Voilà mon sujet

merci de votre reponse

Bonsoir

j'ai aussi un pb
voici le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:13:37, on 27/12/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdcBase.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Users\anne\AppData\Local\uecjjqaf.exe
C:\Program Files\Winsudate\gibusr.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Users\anne\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\QuickTime\QuickTimePlayer.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yougoo.fr/meteo
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: GamesBarBHO Class - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\oberontb.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll (file missing)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Mobile-based device management] %WINDIR%\WindowsMobile\wmdcBase.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [fephgh] "c:\users\anne\appdata\local\fephgh.exe" fephgh
O4 - HKCU\..\Run: [uecjjqaf] "c:\users\anne\appdata\local\uecjjqaf.exe" uecjjqaf
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\anne\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.orange.fr
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab3.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/hou ... hcImpl.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/v ... .2.5.1.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/fr ... oader5.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://jeuxenligne.orange.fr/GameShell/ ... uncher.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/ ... meHost.cab
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Gestionnaire de mise à jour Winsudate (WinSvc) - Winsudate - C:\Program Files\Winsudate\gibsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

A bientot
nanou54
 
Messages: 5
Inscription: 27 Déc 2009 21:15

Re: pb d'infection search setting 1.1

Messagepar Falkra » 28 Déc 2009 11:53

Bonjour,

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
  • Lance le fichier téléchargé par clic droit, exécuter en tant qu'administrateur.
  • Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
  • Choisis maintenant l'option (Recherche). Patiente jusqu'à la fin de la recherche.
  • Poste le rapport généré. (C:\TB.txt)

----------


Télécharge Malwarebytes' Anti-Malware (MBAM)
Si ça ne se télécharge pas, que tu es redirigé, ou que MBAM ne démarre pas, signale-le moi : c'est un symptôme.

  • Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  • Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  • Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  • Sélectionne "Exécuter un examen rapide"
  • Clique sur "Rechercher"
  • L'analyse démarre.
  • A la fin de l'analyse (mais ce n'est pas fini), un message s'affiche :
    L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.

    Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi. N'oublie pas la suite. ;-)
  • Ferme tes navigateurs.
  • Si des malwares ont été détectés, clique sur Afficher les résultats.
    Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  • MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

NB : Si MBAM te demande à redémarrer, fais-le.
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 24424
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: pb d'infection search setting 1.1

Messagepar nanou54 » 28 Déc 2009 20:57

Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3445
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18865

28/12/2009 20:55:51
mbam-log-2009-12-28 (20-55-51).txt

Type de recherche: Examen rapide
Eléments examinés: 98606
Temps écoulé: 9 minute(s), 1 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 18
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Unloaded process successfully.
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Program Files\GamesBar\oberontb.dll (Adware.Gamesbar) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsvc (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ad76633e-e50d-4844-9e7f-4dfbc7c18467} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{daa37aad-f156-4c2c-ac48-3c22ef92ae2f} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cb0d163c-e9f4-4236-9496-0597e24b23a5} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cb0d163c-e9f4-4236-9496-0597e24b23a5} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{cb0d163c-e9f4-4236-9496-0597e24b23a5} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cb0d163c-e9f4-4236-9496-0597e24b23a5} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fephgh (Trojan.Agent.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uecjjqaf (Trojan.Agent.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winusr (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Winsudate (Adware.Gibmedia) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\Users\anne\AppData\Local\uecjjqaf.exe (Trojan.Agent.H) -> Delete on reboot.
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\GamesBar\oberontb.dll (Adware.Gamesbar) -> Delete on reboot.
C:\Program Files\Winsudate\gibcom.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibidl.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibupt.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Users\anne\Local Settings\Application Data\uecjjqaf_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\Users\anne\Local Settings\Application Data\uecjjqaf_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
nanou54
 
Messages: 5
Inscription: 27 Déc 2009 21:15

Re: pb d'infection search setting 1.1

Messagepar nanou54 » 28 Déc 2009 21:26

Le rapport de toolbar-s&d

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T2310 @ 1.46GHz )
BIOS : Default System BIOS
USER : anne ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 090105-0] 4.8.1229 (Activated)
C:\ (Local Disk) - NTFS - Total:69 Go (Free:28 Go)
D:\ (Local Disk) - NTFS - Total:69 Go (Free:66 Go)
E:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 28/12/2009|21:22 )

[ UAC => 1 ]

-----------\\ Recherche de Fichiers / Dossiers ...

C:\ProgramData\GamesBar
C:\ProgramData\GamesBar\09-07-03-20-05-32
C:\ProgramData\GamesBar\09-07-03-20-05-32.xm_
C:\ProgramData\GamesBar\09-07-13-03-29-43
C:\ProgramData\GamesBar\09-07-15-00-07-58
C:\ProgramData\GamesBar\09-07-22-10-16-10
C:\ProgramData\GamesBar\09-07-22-10-16-10.xm_
C:\ProgramData\GamesBar\09-08-24-18-22-45
C:\ProgramData\GamesBar\09-08-24-18-22-45.xm_
C:\ProgramData\GamesBar\09-08-24-18-24-18
C:\ProgramData\GamesBar\09-08-24-18-24-18.xm_
C:\ProgramData\GamesBar\09-09-23-14-27-48
C:\ProgramData\GamesBar\09-09-23-14-27-48.xm_
C:\ProgramData\GamesBar\09-09-28-20-15-04
C:\ProgramData\GamesBar\09-09-28-20-15-04.xm_
C:\ProgramData\GamesBar\09-10-02-14-36-44
C:\ProgramData\GamesBar\09-10-02-14-36-44.xm_
C:\ProgramData\GamesBar\09-10-14-12-00-42
C:\ProgramData\GamesBar\09-10-14-12-00-42.xm_
C:\ProgramData\GamesBar\09-10-14-16-35-17
C:\ProgramData\GamesBar\09-10-14-16-35-17.xm_
C:\ProgramData\GamesBar\09-10-30-20-15-55
C:\ProgramData\GamesBar\09-10-30-20-15-55.xm_
C:\ProgramData\GamesBar\09-10-30-20-18-33
C:\ProgramData\GamesBar\09-10-30-20-18-33.xm_
C:\ProgramData\GamesBar\09-10-30-20-19-24
C:\ProgramData\GamesBar\09-10-30-20-19-24.xm_
C:\ProgramData\GamesBar\09-10-30-20-37-47
C:\ProgramData\GamesBar\09-11-03-19-12-07
C:\ProgramData\GamesBar\09-11-03-19-12-07.xm_
C:\ProgramData\GamesBar\09-11-03-19-13-15
C:\ProgramData\GamesBar\09-11-03-19-13-15.xm_
C:\ProgramData\GamesBar\09-11-03-19-13-36
C:\ProgramData\GamesBar\09-11-03-19-13-36.xm_
C:\ProgramData\GamesBar\09-11-03-19-13-58
C:\ProgramData\GamesBar\09-11-14-18-59-05
C:\ProgramData\GamesBar\09-12-02-12-59-37
C:\ProgramData\GamesBar\09-12-02-12-59-37.xm_
C:\ProgramData\GamesBar\09-12-02-12-59-47
C:\ProgramData\GamesBar\09-12-02-12-59-47.xm_
C:\ProgramData\GamesBar\09-12-24-16-51-51
C:\ProgramData\GamesBar\09-12-25-22-15-22
C:\ProgramData\GamesBar\09-12-27-17-36-35
C:\ProgramData\GamesBar\09-12-27-17-36-35.xm_
C:\ProgramData\GamesBar\09-12-27-17-36-52
C:\ProgramData\GamesBar\09-12-27-17-36-52.xm_
C:\ProgramData\GamesBar\09-12-27-18-29-44
C:\ProgramData\GamesBar\about.gif
C:\ProgramData\GamesBar\action.gif
C:\ProgramData\GamesBar\arcade.gif
C:\ProgramData\GamesBar\artist_colony16x16.gif
C:\ProgramData\GamesBar\azada_216x16.gif
C:\ProgramData\GamesBar\buy.gif
C:\ProgramData\GamesBar\CakeMania_MainStreet16x16.gif
C:\ProgramData\GamesBar\cards.gif
C:\ProgramData\GamesBar\cherry_blossom_murders16x16.gif
C:\ProgramData\GamesBar\citysights16x16.gif
C:\ProgramData\GamesBar\CookingDash_DT_studios16x16.gif
C:\ProgramData\GamesBar\deals.gif
C:\ProgramData\GamesBar\download.gif
C:\ProgramData\GamesBar\dream_day_wedding_viva_las_vegas16x16.gif
C:\ProgramData\GamesBar\farm_frenzy316x16.gif
C:\ProgramData\GamesBar\feedback.gif
C:\ProgramData\GamesBar\help.gif
C:\ProgramData\GamesBar\highlight.gif
C:\ProgramData\GamesBar\insider_tales_casanova16x16.gif
C:\ProgramData\GamesBar\jewel_quest_bundle_fr16x16.gif
C:\ProgramData\GamesBar\jewel_quest_mysteries16x16.gif
C:\ProgramData\GamesBar\jigsaw.gif
C:\ProgramData\GamesBar\kids.gif
C:\ProgramData\GamesBar\little_folk_of_faery16x16.gif
C:\ProgramData\GamesBar\magic_encyclopedia216x16.gif
C:\ProgramData\GamesBar\mahjong.gif
C:\ProgramData\GamesBar\mahjong_memoirs_without_calendar16x16.gif
C:\ProgramData\GamesBar\margrave_manor_216x16.gif
C:\ProgramData\GamesBar\mygames.gif
C:\ProgramData\GamesBar\newGames.gif
C:\ProgramData\GamesBar\oberonconfig.xm_
C:\ProgramData\GamesBar\onload
C:\ProgramData\GamesBar\partner.gif
C:\ProgramData\GamesBar\popup_off.gif
C:\ProgramData\GamesBar\popup_on.gif
C:\ProgramData\GamesBar\PrincessIsabella16x16.gif
C:\ProgramData\GamesBar\puzzle.gif
C:\ProgramData\GamesBar\search.gif
C:\ProgramData\GamesBar\searchHistory.dat
C:\ProgramData\GamesBar\sendafriend.gif
C:\ProgramData\GamesBar\sports.gif
C:\ProgramData\GamesBar\the_mystery_of_the_crystal_portal16x16.gif
C:\ProgramData\GamesBar\treasures_of_montezuma216x16.gif
C:\ProgramData\GamesBar\treasures_of_serengeti16x16.gif
C:\ProgramData\GamesBar\trial.gif
C:\ProgramData\GamesBar\uninstall.gif
C:\ProgramData\GamesBar\update.gif
C:\ProgramData\GamesBar\zumas_revenge16x16.gif
C:\ProgramData\GamesBar\09-07-03-20-05-32\about.gif
C:\ProgramData\GamesBar\09-07-03-20-05-32\feedback.gif
C:\ProgramData\GamesBar\09-07-03-20-05-32\help.gif
C:\ProgramData\GamesBar\09-07-03-20-05-32\partner.gif
C:\ProgramData\GamesBar\09-07-03-20-05-32\search.gif
C:\ProgramData\GamesBar\09-07-03-20-05-32\sendafriend.gif
C:\ProgramData\GamesBar\09-07-03-20-05-32\uninstall.gif
C:\ProgramData\GamesBar\09-07-03-20-05-32\update.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\about.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\action.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\adventures_of_robinson_crusoe16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\agatha_christie_bundle16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\alabama_smith16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\annabel16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\arcade.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\blood_ties16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\buy.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\cards.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\deals.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\download.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\feedback.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\fishdom_h2o16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\help.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\highlight.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\jigsaw.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\kids.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\laura_jones16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\mahjong.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\mortimer_beckett_spooky_manor16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\mygames.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\mystery_of_unicorn_castle16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\mystery_pi_the_new_york_fortune16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\newGames.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\partner.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\popup_off.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\popup_on.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\puzzle.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\search.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\sendafriend.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\sports.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\the_secret_of_margrave_manor16x16.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\trial.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\uninstall.gif
C:\ProgramData\GamesBar\09-07-13-03-29-43\update.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\about.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\action.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\adventures_of_robinson_crusoe16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\agatha_christie_bundle16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\alabama_smith16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\annabel16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\arcade.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\blood_ties16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\buy.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\cards.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\deals.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\download.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\feedback.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\fishdom_h2o16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\help.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\highlight.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\jigsaw.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\kids.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\laura_jones16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\mahjong.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\mortimer_beckett_spooky_manor16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\mygames.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\mystery_of_unicorn_castle16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\mystery_pi_the_new_york_fortune16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\newGames.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\partner.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\popup_off.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\popup_on.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\puzzle.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\search.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\sendafriend.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\sports.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\the_secret_of_margrave_manor16x16.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\trial.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\uninstall.gif
C:\ProgramData\GamesBar\09-07-15-00-07-58\update.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\about.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\art_detective16x16.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\feedback.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\help.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\hidden_island16x16.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\highlight.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\newGames.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\partner.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\popup_off.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\popup_on.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\search.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\sendafriend.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\uninstall.gif
C:\ProgramData\GamesBar\09-07-22-10-16-10\update.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\about.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\adventures_of_robinson_crusoe16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\download.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\dream_chronicles16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\dream_chronicles_216x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\escape_rosecliff_island16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\feedback.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\help.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\herods_lost_tomb16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\highlight.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\my_kingdom_for_the_princess16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\newGames.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\partner.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\party_down16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\popup_off.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\popup_on.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\pure_hidden16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\ranch_rush16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\search.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\secrets-of-great-art16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\sendafriend.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\sprill16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\uninstall.gif
C:\ProgramData\GamesBar\09-08-24-18-22-45\update.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\about.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\dream_chronicles_216x16.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\feedback.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\help.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\herods_lost_tomb16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\highlight.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\my_kingdom_for_the_princess16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\newGames.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\partner.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\party_down16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\popup_off.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\popup_on.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\search.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\sendafriend.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\sprill16x16.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\uninstall.gif
C:\ProgramData\GamesBar\09-08-24-18-24-18\update.gif
C:\ProgramData\GamesBar\09-09-28-20-15-04\about.gif
C:\ProgramData\GamesBar\09-09-28-20-15-04\feedback.gif
C:\ProgramData\GamesBar\09-09-28-20-15-04\partner.gif
C:\ProgramData\GamesBar\09-09-28-20-15-04\sendafriend.gif
C:\ProgramData\GamesBar\09-09-28-20-15-04\update.gif
C:\ProgramData\GamesBar\09-10-02-14-36-44\about.gif
C:\ProgramData\GamesBar\09-10-02-14-36-44\partner.gif
C:\ProgramData\GamesBar\09-10-02-14-36-44\sendafriend.gif
C:\ProgramData\GamesBar\09-10-02-14-36-44\update.gif
C:\ProgramData\GamesBar\09-10-14-12-00-42\about.gif
C:\ProgramData\GamesBar\09-10-14-12-00-42\partner.gif
C:\ProgramData\GamesBar\09-10-14-12-00-42\sendafriend.gif
C:\ProgramData\GamesBar\09-10-14-12-00-42\update.gif
C:\ProgramData\GamesBar\09-10-14-16-35-17\about.gif
C:\ProgramData\GamesBar\09-10-14-16-35-17\partner.gif
C:\ProgramData\GamesBar\09-10-14-16-35-17\update.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\about.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\artist_colony16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\CakeMania_MainStreet16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\CookingDash_DT_studios16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\download.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\dream_day_wedding_viva_las_vegas16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\escape_rosecliff_island16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\farm_frenzy316x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\feedback.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\help.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\highlight.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\jewel_quest_bundle_fr16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\KellyGreen_GardenQueen16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\miss_teri_tale3_fr16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\mystery_pi16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\natalie_brooks_the_lost_kingdom16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\newGames.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\partner.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\popup_off.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\popup_on.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\restaurant_rush16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\search.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\sendafriend.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\uninstall.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\update.gif
C:\ProgramData\GamesBar\09-10-30-20-15-55\zumas_revenge16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\about.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\download.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\feedback.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\help.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\highlight.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\KellyGreen_GardenQueen16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\miss_teri_tale3_fr16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\mystery_pi16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\natalie_brooks_the_lost_kingdom16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\newGames.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\partner.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\popup_off.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\popup_on.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\restaurant_rush16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\search.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\sendafriend.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\uninstall.gif
C:\ProgramData\GamesBar\09-10-30-20-18-33\update.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\about.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\artist_colony16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\CakeMania_MainStreet16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\download.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\farm_frenzy316x16.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\feedback.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\help.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\highlight.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\KellyGreen_GardenQueen16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\miss_teri_tale3_fr16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\mystery_pi16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\natalie_brooks_the_lost_kingdom16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\newGames.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\partner.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\popup_off.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\popup_on.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\restaurant_rush16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\search.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\sendafriend.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\uninstall.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\update.gif
C:\ProgramData\GamesBar\09-10-30-20-19-24\zumas_revenge16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\about.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\action.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\arcade.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\buy.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\cards.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\CookingDash_DT_studios16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\deals.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\download.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\dream_chronicles_216x16.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\dream_day_wedding_viva_las_vegas16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\escape_rosecliff_island16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\feedback.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\help.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\highlight.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\jewel_quest_bundle_fr16x16.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\jigsaw.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\kids.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\mahjong.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\mygames.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\newGames.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\partner.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\popup_off.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\popup_on.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\puzzle.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\samantha_swift_216x16.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\search.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\sendafriend.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\sports.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\trial.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\uninstall.gif
C:\ProgramData\GamesBar\09-10-30-20-37-47\update.gif
C:\ProgramData\GamesBar\09-11-03-19-12-07\about.gif
C:\ProgramData\GamesBar\09-11-03-19-12-07\feedback.gif
C:\ProgramData\GamesBar\09-11-03-19-12-07\help.gif
C:\ProgramData\GamesBar\09-11-03-19-12-07\partner.gif
C:\ProgramData\GamesBar\09-11-03-19-12-07\sendafriend.gif
C:\ProgramData\GamesBar\09-11-03-19-12-07\uninstall.gif
C:\ProgramData\GamesBar\09-11-03-19-12-07\update.gif
C:\ProgramData\GamesBar\09-11-03-19-13-15\about.gif
C:\ProgramData\GamesBar\09-11-03-19-13-15\feedback.gif
C:\ProgramData\GamesBar\09-11-03-19-13-15\help.gif
C:\ProgramData\GamesBar\09-11-03-19-13-15\partner.gif
C:\ProgramData\GamesBar\09-11-03-19-13-15\sendafriend.gif
C:\ProgramData\GamesBar\09-11-03-19-13-15\update.gif
C:\ProgramData\GamesBar\09-11-03-19-13-36\about.gif
C:\ProgramData\GamesBar\09-11-03-19-13-36\partner.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\about.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\action.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\arcade.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\buy.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\cards.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\CookingDash_DT_studios16x16.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\deals.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\download.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\dream_chronicles_216x16.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\dream_day_wedding_viva_las_vegas16x16.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\escape_rosecliff_island16x16.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\feedback.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\help.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\highlight.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\jewel_quest_bundle_fr16x16.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\jigsaw.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\kids.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\mahjong.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\mygames.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\newGames.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\partner.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\popup_off.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\popup_on.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\puzzle.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\samantha_swift_216x16.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\search.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\sendafriend.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\sports.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\trial.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\uninstall.gif
C:\ProgramData\GamesBar\09-11-03-19-13-58\update.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\about.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\action.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\arcade.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\buy.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\cards.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\CookingDash_DT_studios16x16.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\deals.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\download.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\dream_chronicles_216x16.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\dream_day_wedding_viva_las_vegas16x16.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\escape_rosecliff_island16x16.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\feedback.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\help.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\highlight.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\jewel_quest_bundle_fr16x16.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\jigsaw.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\kids.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\mahjong.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\mygames.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\newGames.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\partner.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\popup_off.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\popup_on.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\puzzle.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\samantha_swift_216x16.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\search.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\sendafriend.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\sports.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\trial.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\uninstall.gif
C:\ProgramData\GamesBar\09-11-14-18-59-05\update.gif
C:\ProgramData\GamesBar\09-12-02-12-59-37\about.gif
C:\ProgramData\GamesBar\09-12-02-12-59-37\partner.gif
C:\ProgramData\GamesBar\09-12-02-12-59-37\sendafriend.gif
C:\ProgramData\GamesBar\09-12-02-12-59-37\update.gif
C:\ProgramData\GamesBar\09-12-02-12-59-47\about.gif
C:\ProgramData\GamesBar\09-12-02-12-59-47\partner.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\about.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\action.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\arcade.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\artist_colony16x16.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\buy.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\CakeMania_MainStreet16x16.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\cards.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\deals.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\download.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\dream_day_wedding_viva_las_vegas16x16.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\farm_frenzy316x16.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\feedback.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\help.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\highlight.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\jigsaw.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\kids.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\little_folk_of_faery16x16.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\mahjong.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\mygames.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\newGames.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\partner.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\popup_off.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\popup_on.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\PrincessIsabella16x16.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\puzzle.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\search.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\sendafriend.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\sports.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\treasures_of_serengeti16x16.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\trial.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\uninstall.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\update.gif
C:\ProgramData\GamesBar\09-12-24-16-51-51\zumas_revenge16x16.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\about.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\action.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\arcade.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\artist_colony16x16.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\buy.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\CakeMania_MainStreet16x16.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\cards.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\deals.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\download.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\dream_day_wedding_viva_las_vegas16x16.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\farm_frenzy316x16.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\feedback.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\help.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\highlight.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\jigsaw.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\kids.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\little_folk_of_faery16x16.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\mahjong.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\mygames.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\newGames.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\partner.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\popup_off.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\popup_on.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\PrincessIsabella16x16.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\puzzle.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\search.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\sendafriend.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\sports.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\treasures_of_serengeti16x16.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\trial.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\uninstall.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\update.gif
C:\ProgramData\GamesBar\09-12-25-22-15-22\zumas_revenge16x16.gif
C:\ProgramData\GamesBar\09-12-27-17-36-35\about.gif
C:\ProgramData\GamesBar\09-12-27-17-36-35\partner.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\about.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\cherry_blossom_murders16x16.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\feedback.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\help.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\highlight.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\insider_tales_casanova16x16.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\newGames.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\partner.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\popup_off.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\popup_on.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\search.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\sendafriend.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\uninstall.gif
C:\ProgramData\GamesBar\09-12-27-17-36-52\update.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\about.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\action.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\arcade.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\artist_colony16x16.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\buy.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\CakeMania_MainStreet16x16.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\cards.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\deals.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\download.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\dream_day_wedding_viva_las_vegas16x16.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\farm_frenzy316x16.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\feedback.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\help.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\highlight.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\jigsaw.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\kids.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\little_folk_of_faery16x16.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\mahjong.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\mygames.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\newGames.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\partner.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\popup_off.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\popup_on.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\PrincessIsabella16x16.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\puzzle.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\search.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\sendafriend.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\sports.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\treasures_of_serengeti16x16.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\trial.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\uninstall.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\update.gif
C:\ProgramData\GamesBar\09-12-27-18-29-44\zumas_revenge16x16.gif
C:\ProgramData\GamesBar\onload\loading.gif
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\GamesBar
C:\Program Files\GamesBar
C:\Program Files\GamesBar\Localization2-French.ini
C:\Program Files\GamesBar\uninst.exe

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.yougoo.fr/meteo"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"SearchMigratedDefaultURL"="http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7"
"Default_Search_URL"="http://www.google.com/ie"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page Redirect Cache"="http://fr.msn.com/?ocid=iehp"
"Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://fr.fr.acer.yahoo.com"
"Default_Page_URL"="http://fr.fr.acer.yahoo.com"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Local Page"="C:\\Windows\\System32\\blank.htm"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 28/12/2009|21:23 - Option : [1]

-----------\\ Fin du rapport a 21:23:35,06

Merci
nanou54
 
Messages: 5
Inscription: 27 Déc 2009 21:15

Re: pb d'infection search setting 1.1

Messagepar Falkra » 29 Déc 2009 08:05

Bon, il y a eu du ménage de fait, comme tu peuw le voir, redémarre si ça n'a pas déjà été fait, et poste un nouveau rapport HijackThis stp.

Ca doit mieux tourner là. :wink:
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 24424
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1

Re: pb d'infection search setting 1.1

Messagepar nanou54 » 29 Déc 2009 12:28

voici le dernier rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:13:37, on 27/12/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdcBase.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Users\anne\AppData\Local\uecjjqaf.exe
C:\Program Files\Winsudate\gibusr.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Users\anne\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\QuickTime\QuickTimePlayer.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yougoo.fr/meteo
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: GamesBarBHO Class - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\oberontb.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll (file missing)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Mobile-based device management] %WINDIR%\WindowsMobile\wmdcBase.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [fephgh] "c:\users\anne\appdata\local\fephgh.exe" fephgh
O4 - HKCU\..\Run: [uecjjqaf] "c:\users\anne\appdata\local\uecjjqaf.exe" uecjjqaf
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\anne\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.orange.fr
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab3.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/hou ... hcImpl.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/v ... .2.5.1.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/fr ... oader5.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://jeuxenligne.orange.fr/GameShell/ ... uncher.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/ ... meHost.cab
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Gestionnaire de mise à jour Winsudate (WinSvc) - Winsudate - C:\Program Files\Winsudate\gibsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 12832 bytes

c super y a plus de search setting et ca tourne mieux

merci pour tout
nanou54
 
Messages: 5
Inscription: 27 Déc 2009 21:15

Re: pb d'infection search setting 1.1

Messagepar Falkra » 29 Déc 2009 18:01

Refais un rapport HijackThis stp, en le démarrant par clic droit, exécuter en tant qu'administrateur, pour faire le rapport stp. :)
Avatar de l’utilisateur
Falkra
Admin libellules.ch
Admin libellules.ch
 
Messages: 24424
Inscription: 30 Jan 2005 13:44
Localisation: 127.0.0.1


Retourner vers Désinfections et demandes d'analyse

Qui est en ligne

Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 2 invités